The claim not much has changed can be substantiated by reading the article, and by looking in CVS. Modern code review tools provide public conversation of the

The claim not much has changed can be substantiated by reading the article, and by looking in CVS. Modern code review tools provide public conversation of the code in question, and allow people to sign off on it. Is LibreSSL doing this? How can I trace a change or branch to a discussion (if there are even branches)? How are others supposed to easily look into their changes? They say this is a problem in the article we are talking about with their 12,000+ line diffs. What kind of audit? The traditional kind. Like the third party one the OpenSSL people are funding. Extra tests would be good if they are rewriting functions, which according to the article is what they did past month one. Is their test plan do a release and see what happens? I can't tell, since I can't see a test plan anywhere. If you're changing a function, and not doing so with even basic tests, and are holding your development practices up as 'best practice' you are lying. I'm being cynical because I care. They aren't doing many things the OpenSSL project themselves were taken to task for. As well, the OpenSSL project has now taken on many of the practices that LibreSSL are doing, but also they're doing much more (see their roadmap https://www.openssl.org/about/roadmap.html https://www.openssl.org/about/roadmap.html). To let LibreSSL get away with being careless is kind of silly when they are holding it up as being better.